ata-validator 1.61.3 → 1.62.0

package/lib/js-compiler.js

@@ -230,6 +230,17 @@ const useSafeEngine = (src) => {
   if (_nativeIsLinear(src)) return false
   return patternIsSafe(src)
 }
+// Whether the generators may carry a pattern at all. A pattern with a
+// Unicode property escape cannot take the linear engine, so it is written
+// for the platform RegExp only when that is shown to run it in linear time
+// (nativeIsLinear reads the escape as one class); otherwise the schema is
+// declined to the interpreted engine. `^(\p{L}+)+$` went to the RegExp
+// unchecked and took a second on 28 letters and a '!'.
+function patternEngineOk (src) {
+  if (typeof src !== 'string' || !PROP_ESCAPE.test(src)) return true
+  if (_nativeIsLinear === null) _nativeIsLinear = require('./regex-linear').nativeIsLinear
+  return _nativeIsLinear(src)
+}
 
 // Closure value for a patternProperties/propertyNames regex: the linear-time
 // safe matcher when the pattern is in the supported subset (and flag the ctx so
@@ -568,10 +579,11 @@ function compileToJS(schema, defs, schemaMap) {
 
   // format — hand-written fast checks. A format the code generator asserts
   // but this path cannot is a decline, not a pass.
-  if (schema.format) {
-    const fc = formatChecks()[schema.format]
-    if (fc) checks.push((d) => typeof d !== 'string' || fc(d))
-    else if (FORMAT_CODEGEN[schema.format]) return null
+  if (typeof schema.format === 'string') {
+    const table = formatChecks()
+    const fc = Object.hasOwn(table, schema.format) ? table[schema.format] : undefined
+    if (typeof fc === 'function') checks.push((d) => typeof d !== 'string' || fc(d))
+    else if (Object.hasOwn(FORMAT_CODEGEN, schema.format)) return null
   }
 
   // array size
@@ -836,8 +848,52 @@ function buildTypeCheck(types) {
 // 0.1 with -0.09999999999999995, which is neither near zero nor near the
 // divisor, so it called -1 not a multiple of 0.1 when -1 / 0.1 is exactly -10.
 // Emitted from one place because the expression stood in six.
+// Whether a value of `known` type (proven by a parent) also satisfies
+// `types`, so the child's own type check can be skipped: the same type, or
+// an integer where a number is asked for.
+function typeImplied (known, types) {
+  for (let i = 0; i < types.length; i++) {
+    if (types[i] === known) return true
+    if (types[i] === 'number' && known === 'integer') return true
+  }
+  return false
+}
+// The helper name a user format function is bound as. One name per format
+// name, whatever the characters: 'foo-bar' and 'foo_bar' both came out as
+// `_uf_foo_bar`, and the first function bound answered for both. Characters
+// outside [A-Za-z0-9_] are written as `$` and four hex digits, so the map
+// is one to one and both generators and the ahead-of-time output agree on it.
+function ufName (format) {
+  return '_uf_' + String(format).replace(/[^A-Za-z0-9_]/g, (c) => '$' + c.charCodeAt(0).toString(16).padStart(4, '0'))
+}
+// The caller's own format function by that name, or null. An inherited
+// value (`constructor`) is not one, as tier 0 and the interpreted engine
+// read the option.
+// Binds the function as a closure parameter of the generated function, once
+// per format name, and remembers the name for the emitters.
+function bindUserFormat (ctx, format, fn) {
+  const closureName = ufName(format)
+  if (!ctx.closureVars) { ctx.closureVars = []; ctx.closureVals = [] }
+  if (!ctx.closureVars.includes(closureName)) {
+    ctx.closureVars.push(closureName)
+    ctx.closureVals.push(fn)
+  }
+  if (!ctx.formatNames) ctx.formatNames = new Map()
+  ctx.formatNames.set(closureName, format)
+  return closureName
+}
+function formatNameOf (ctx, closureName) {
+  const name = ctx.formatNames ? ctx.formatNames.get(closureName) : undefined
+  return name === undefined ? null : name
+}
+function userFormatFn (userFormats, format) {
+  if (!userFormats || typeof format !== 'string' || !Object.prototype.hasOwnProperty.call(userFormats, format)) return null
+  const fn = userFormats[format]
+  return typeof fn === 'function' ? fn : null
+}
 function multipleOfBad(v, m) {
-  if (m === 0) return 'true'
+  m = numLit(m)
+  if (+m === 0) return 'true'
   // Negated rather than written as "the distance is too large": a quotient
   // that overflows to Infinity makes the distance NaN, and every comparison
   // with NaN is false, so the direct form called 1e308 a multiple of
@@ -1444,6 +1500,36 @@ function sharedDefNames (root, defs) {
     const def = defs[name]
     if (n >= 2 && def && typeof def === 'object' && JSON.stringify(def).length >= SHARED_DEF_MIN_CHARS) out.add(name)
   }
+  // A definition small as written can still be large once its references
+  // are followed: one that applies the next one twice, layer after layer, is
+  // 2^n expanded. The $dynamicRef unrolling makes exactly that, and hands
+  // the same copy to both places, so the count above (by node, from the
+  // schema as given, whose references name the original definitions) saw
+  // none of it, and sixteen layers came to a verdict function too large for
+  // the stack. Here references are counted at every place they are reached
+  // from in the definitions the generators read, and a definition applied
+  // twice whose expansion passes SHARED_DEF_EXPANDED_MIN is shared as well.
+  // The bound is high so ordinary definitions stay inline: at 256 KB the set
+  // is unchanged on every SchemaStore schema (at 8 KB six changed, and
+  // web-types measured about 3% slower).
+  const edges = new Map()
+  const seen2 = new WeakSet()
+  const walk2 = (node) => {
+    if (node === null || typeof node !== 'object') return
+    if (typeof node.$ref === 'string') {
+      const m = /^#\/(?:\$defs|definitions)\/([^/]+)$/.exec(node.$ref)
+      if (m) edges.set(m[1], (edges.get(m[1]) || 0) + 1)
+    }
+    if (seen2.has(node)) return
+    seen2.add(node)
+    for (const v of Object.values(node)) walk2(v)
+  }
+  walk2(defs)
+  for (const [name, n] of edges) {
+    if (n < 2 || out.has(name)) continue
+    const def = defs[name]
+    if (def && typeof def === 'object' && expandedChars(def, SHARED_DEF_EXPANDED_MIN, defs) >= SHARED_DEF_EXPANDED_MIN) out.add(name)
+  }
   return out
 }
 // Raising this to inline small definitions at every site was measured and
@@ -1455,6 +1541,7 @@ function sharedDefNames (root, defs) {
 // was tried too and gave 1.5x, not enough to carry its complexity. Left as a
 // known trade: on that shape the shared function costs 27 ns a call.
 const SHARED_DEF_MIN_CHARS = 120
+const SHARED_DEF_EXPANDED_MIN = 256 * 1024
 
 // A small definition applied at many places is called with objects of many
 // shapes, one or two per place, and V8 gives a function's property reads up
@@ -1661,6 +1748,27 @@ function refStringsOf(node) {
   return set
 }
 
+// The keywords whose values the generators write into source as numbers. A
+// value that is not a finite number is not written at all: the gate hands
+// the schema to the interpreted engine. Written as it came, a string value
+// was source, so `minimum: '0||(process.exitCode=7)'` ran.
+const NUMERIC_KEYWORDS = ['minimum', 'maximum', 'exclusiveMinimum', 'exclusiveMaximum', 'multipleOf', 'minLength', 'maxLength', 'minItems', 'maxItems', 'minProperties', 'maxProperties', 'minContains', 'maxContains']
+function hasNonNumericBound (node) {
+  for (let i = 0; i < NUMERIC_KEYWORDS.length; i++) {
+    const v = node[NUMERIC_KEYWORDS[i]]
+    // v - v is 0 for a finite number and NaN for NaN and the infinities.
+    if (v !== undefined && (typeof v !== 'number' || v - v !== 0)) return true
+  }
+  return false
+}
+// Every number the generators write into source goes through here. The gate
+// has already turned away a value that is not a finite number; should one
+// reach this anyway, the schema declines rather than becoming code.
+function numLit (x) {
+  if (typeof x !== 'number' || !Number.isFinite(x)) throw DECLINE
+  return String(x)
+}
+
 function codegenSafe(schema, schemaMap) {
   if (typeof schema === 'boolean') return true
   if (typeof schema !== 'object' || schema === null) return true
@@ -1670,6 +1778,17 @@ function codegenSafe(schema, schemaMap) {
   // vacuous, so hand the schema over rather than silently ignore a constraint.
   if (schema.propertyDependencies !== undefined) return false
 
+  if (hasNonNumericBound(schema)) return false
+
+  // A pattern the linear engine cannot take (a Unicode property escape) runs
+  // on the platform RegExp only when that is shown to be linear too; any
+  // other goes to the interpreted engine, like a pattern with a backreference.
+  if (typeof schema.pattern === 'string' && !patternEngineOk(schema.pattern)) return false
+  if (schema.patternProperties && typeof schema.patternProperties === 'object') {
+    for (const pat of Object.keys(schema.patternProperties)) if (!patternEngineOk(pat)) return false
+  }
+  if (schema.propertyNames && typeof schema.propertyNames === 'object' && typeof schema.propertyNames.pattern === 'string' && !patternEngineOk(schema.propertyNames.pattern)) return false
+
   // Only bail on $dynamicRef if it can't be resolved at compile time
   if (schema.$dynamicRef && !schema.$dynamicRef.startsWith('#')) return false
 
@@ -2572,6 +2691,7 @@ const _refFreeLength = new WeakMap()
 const DYN_DROP = new Set(['$id', '$anchor', '$dynamicAnchor', '$defs', 'definitions'])
 const BOOL_TRUE = { bool: true }
 const BOOL_FALSE = { bool: false }
+const DYN_COPY_BUDGET = 4096
 function expandDynamicScopes(root, schemaMap) {
   if (root === null || typeof root !== 'object' || Array.isArray(root)) return null
   const { indexSchemas, resolveRef, splitFragment, resolveUri } = require('./interpreter')._refInternals
@@ -2634,6 +2754,11 @@ function expandDynamicScopes(root, schemaMap) {
     const e = { copy: Array.isArray(node) ? [] : {}, sig, name: null, referenced: false }
     bySig.set(sig, e)
     order.push(e)
+    // One copy per node and scope chain: two embedded resources per layer
+    // that both reference the next layer make 2^i copies of layer i, and
+    // sixteen layers ran out of stack after a second. Past the budget the
+    // unrolling declines and the interpreted engine answers.
+    if (order.length > DYN_COPY_BUDGET) { fail = true; return e }
     if (Array.isArray(node)) { for (const x of node) e.copy.push(copyValue(x, base, chain)); return e }
     const out = e.copy
     // Only a schema node reads `$ref` as a reference and carries an `$id`; in
@@ -2664,7 +2789,8 @@ function expandDynamicScopes(root, schemaMap) {
   // (a type name, a limit, a required name) is kept as it is.
   const copyValue = (v, base, chain) => (v !== null && typeof v === 'object') || typeof v === 'boolean' ? entryFor(v, base, chain).copy : v
   const rootBase = state.nodeBase.get(root)
-  const rootEntry = entryFor(root, rootBase, [rootBase])
+  let rootEntry
+  try { rootEntry = entryFor(root, rootBase, [rootBase]) } catch (e) { if (e instanceof RangeError) return null; throw e }
   if (fail) return null
   const rootCopy = rootEntry.copy
   const defsKey = root.$defs && typeof root.$defs === 'object' ? '$defs' : (root.definitions && typeof root.definitions === 'object' ? 'definitions' : '$defs')
@@ -2815,8 +2941,8 @@ const VERDICT_SPLIT = 64 * 1024
 // stay expanded and keep their speed.
 const EXPANDED_SHARE = 400 * 1024
 const SIZE_SKIPS = new Set(['$defs', 'definitions', 'description', 'title', 'examples', 'default', '$comment', 'markdownDescription', 'deprecated', 'readOnly', 'writeOnly'])
-function expandedChars (root, limit) {
-  const defs = (root && (root.$defs || root.definitions)) || {}
+function expandedChars (root, limit, rootDefs) {
+  const defs = rootDefs || (root && (root.$defs || root.definitions)) || {}
   const memo = new Map()
   const size = (n, stack) => {
     if (n === null || typeof n !== 'object') return 8
@@ -3185,11 +3311,7 @@ function attachHeavy (boolFn, P) {
       if (closureNames[i].startsWith('_uf_')) {
         // The format's own name, so an emitter can look it up at runtime
         // instead of embedding the function.
-        let format = null
-        for (const key of Object.keys(ctx.userFormats)) {
-          if (ctx.userFormats[key] === closureValues[i]) { format = key; break }
-        }
-        fmtEntries.push({ name: closureNames[i], fn: closureValues[i], format })
+        fmtEntries.push({ name: closureNames[i], fn: closureValues[i], format: formatNameOf(ctx, closureNames[i]) })
       }
     }
     if (fmtEntries.length) boolFn._formatClosures = fmtEntries
@@ -3312,7 +3434,7 @@ function needsLocal(schema) {
     if (schema.minLength !== undefined) checkCount++
     if (schema.maxLength !== undefined) checkCount++
     if (schema.pattern) checkCount++
-    if (schema.format) checkCount++
+    if (schema.format !== undefined) checkCount++
   } else if (t === 'integer' || t === 'number') {
     if (schema.minimum !== undefined) checkCount++
     if (schema.maximum !== undefined) checkCount++
@@ -3345,26 +3467,26 @@ function tryGenCombined(schema, access, ctx) {
     : `{const _v=${access};if(${conds.join('||')})return false}`
 
   if (t === 'string') {
-    if (schema.pattern || schema.format) return null
+    if (schema.pattern || schema.format !== undefined) return null
     // s.length is an upper bound on cpLen and at least cpLen / 2 (worst case
     // all-surrogate). Use s.length fast paths and only call _cpLen in the
     // uncertain band; ASCII strings (>99% of real data) skip _cpLen entirely.
     if (schema.minLength !== undefined && schema.maxLength !== undefined) {
-      const M = schema.minLength
-      const X = schema.maxLength
+      const M = +numLit(schema.minLength)
+      const X = +numLit(schema.maxLength)
       const v2 = isIdent ? access : '_v'
       const prelude = isIdent ? '' : `const _v=${access};`
       return `{${prelude}if(typeof ${v2}!=='string')return false;const _lv=${v2}.length;if(_lv<${M}||_lv>${X * 2})return false;if(_lv<${M * 2}||_lv>${X}){const _cp=_cpLen(${v2});if(_cp<${M}||_cp>${X})return false}}`
     }
     const conds = [`typeof _v!=='string'`]
     if (schema.minLength !== undefined && schema.minLength > 0) {
-      const M = schema.minLength
+      const M = +numLit(schema.minLength)
       conds.push(`_v.length<${M}`)
       // For M=1, length<1 already catches all failures (any non-empty string has cpLen>=1).
       if (M > 1) conds.push(`_v.length<${M * 2}&&_cpLen(_v)<${M}`)
     }
     if (schema.maxLength !== undefined) {
-      const X = schema.maxLength
+      const X = +numLit(schema.maxLength)
       // For X=0, only empty string passes, length>0 fails — no cpLen needed.
       if (X === 0) {
         conds.push(`_v.length>0`)
@@ -3379,10 +3501,10 @@ function tryGenCombined(schema, access, ctx) {
 
   if (t === 'integer') {
     const conds = [`!Number.isInteger(_v)`]
-    if (schema.minimum !== undefined) conds.push(`_v<${schema.minimum}`)
-    if (schema.maximum !== undefined) conds.push(`_v>${schema.maximum}`)
-    if (schema.exclusiveMinimum !== undefined) conds.push(`_v<=${schema.exclusiveMinimum}`)
-    if (schema.exclusiveMaximum !== undefined) conds.push(`_v>=${schema.exclusiveMaximum}`)
+    if (schema.minimum !== undefined) conds.push(`_v<${numLit(schema.minimum)}`)
+    if (schema.maximum !== undefined) conds.push(`_v>${numLit(schema.maximum)}`)
+    if (schema.exclusiveMinimum !== undefined) conds.push(`_v<=${numLit(schema.exclusiveMinimum)}`)
+    if (schema.exclusiveMaximum !== undefined) conds.push(`_v>=${numLit(schema.exclusiveMaximum)}`)
     if (schema.multipleOf !== undefined) conds.push(`(${multipleOfBad('_v', schema.multipleOf)})`)
     if (conds.length < 2) return null
     return bind(conds)
@@ -3390,10 +3512,10 @@ function tryGenCombined(schema, access, ctx) {
 
   if (t === 'number') {
     const conds = [`!Number.isFinite(_v)`]
-    if (schema.minimum !== undefined) conds.push(`_v<${schema.minimum}`)
-    if (schema.maximum !== undefined) conds.push(`_v>${schema.maximum}`)
-    if (schema.exclusiveMinimum !== undefined) conds.push(`_v<=${schema.exclusiveMinimum}`)
-    if (schema.exclusiveMaximum !== undefined) conds.push(`_v>=${schema.exclusiveMaximum}`)
+    if (schema.minimum !== undefined) conds.push(`_v<${numLit(schema.minimum)}`)
+    if (schema.maximum !== undefined) conds.push(`_v>${numLit(schema.maximum)}`)
+    if (schema.exclusiveMinimum !== undefined) conds.push(`_v<=${numLit(schema.exclusiveMinimum)}`)
+    if (schema.exclusiveMaximum !== undefined) conds.push(`_v>=${numLit(schema.exclusiveMaximum)}`)
     if (schema.multipleOf !== undefined) conds.push(`(${multipleOfBad('_v', schema.multipleOf)})`)
     if (conds.length < 2) return null
     return bind(conds)
@@ -3575,7 +3697,11 @@ function genCodeNode(schema, v, lines, ctx, knownType) {
   const types = schema.type ? (Array.isArray(schema.type) ? schema.type : [schema.type]) : null
   let effectiveType = knownType
   if (types) {
-    if (!knownType) {
+    // The parent's proven type stands in for this node's check only when it
+    // implies it. A narrower or different type (`type: number` over `allOf:
+    // [{type: integer}]`, a dependentSchemas branch of another type) keeps
+    // its own check: it used to be dropped, and 1.5 passed as an integer.
+    if (!knownType || !typeImplied(knownType, types)) {
       // Emit the type check — use direct negation for single types (avoids !() wrapper)
       if (types.length === 1) {
         switch (types[0]) {
@@ -3708,13 +3834,12 @@ function genCodeNode(schema, v, lines, ctx, knownType) {
   // and the interpreted engine reads it the same way. With `type: number` the
   // type check has already turned it away, so the guard is only needed here.
   const numGuard = isNum ? '' : `Number.isFinite(${v})&&`
-  if (schema.minimum !== undefined) lines.push(`if(${numGuard}${v}<${schema.minimum})return false`)
-  if (schema.maximum !== undefined) lines.push(`if(${numGuard}${v}>${schema.maximum})return false`)
-  if (schema.exclusiveMinimum !== undefined) lines.push(`if(${numGuard}${v}<=${schema.exclusiveMinimum})return false`)
-  if (schema.exclusiveMaximum !== undefined) lines.push(`if(${numGuard}${v}>=${schema.exclusiveMaximum})return false`)
+  if (schema.minimum !== undefined) lines.push(`if(${numGuard}${v}<${numLit(schema.minimum)})return false`)
+  if (schema.maximum !== undefined) lines.push(`if(${numGuard}${v}>${numLit(schema.maximum)})return false`)
+  if (schema.exclusiveMinimum !== undefined) lines.push(`if(${numGuard}${v}<=${numLit(schema.exclusiveMinimum)})return false`)
+  if (schema.exclusiveMaximum !== undefined) lines.push(`if(${numGuard}${v}>=${numLit(schema.exclusiveMaximum)})return false`)
   if (schema.multipleOf !== undefined) {
-    const m = schema.multipleOf
-    const bad = `(${multipleOfBad(v, m)})`
+    const bad = `(${multipleOfBad(v, schema.multipleOf)})`
     lines.push(`if(${numGuard}${bad})return false`)
   }
 
@@ -3727,15 +3852,15 @@ function genCodeNode(schema, v, lines, ctx, knownType) {
   // Only call _cpLen in the uncertain band. ASCII strings (>99% of real data)
   // never enter the band.
   if (schema.minLength !== undefined && schema.maxLength !== undefined) {
-    const M = schema.minLength
-    const X = schema.maxLength
+    const M = +numLit(schema.minLength)
+    const X = +numLit(schema.maxLength)
     const li = ctx.varCounter++
     const lv = `_l${li}`
     const body = `{const ${lv}=${v}.length;if(${lv}<${M}||${lv}>${X * 2})return false;if(${lv}<${M * 2}||${lv}>${X}){const _cp=_cpLen(${v});if(_cp<${M}||_cp>${X})return false}}`
     lines.push(isStr ? body : `if(typeof ${v}==='string')${body}`)
   } else {
     if (schema.minLength !== undefined && schema.minLength > 0) {
-      const M = schema.minLength
+      const M = +numLit(schema.minLength)
       // M==1: length<1 already catches empty strings (any non-empty string has cpLen>=1).
       const body = M === 1
         ? `if(${v}.length<1)return false`
@@ -3743,7 +3868,7 @@ function genCodeNode(schema, v, lines, ctx, knownType) {
       lines.push(isStr ? body : `if(typeof ${v}==='string'){${body}}`)
     }
     if (schema.maxLength !== undefined) {
-      const X = schema.maxLength
+      const X = +numLit(schema.maxLength)
       // X==0: only empty string passes, no cpLen needed.
       const body = X === 0
         ? `if(${v}.length>0)return false`
@@ -3753,12 +3878,12 @@ function genCodeNode(schema, v, lines, ctx, knownType) {
   }
 
   // array size — skip guard if known array
-  if (schema.minItems !== undefined) lines.push(isArr ? `if(${v}.length<${schema.minItems})return false` : `if(Array.isArray(${v})&&${v}.length<${schema.minItems})return false`)
-  if (schema.maxItems !== undefined) lines.push(isArr ? `if(${v}.length>${schema.maxItems})return false` : `if(Array.isArray(${v})&&${v}.length>${schema.maxItems})return false`)
+  if (schema.minItems !== undefined) lines.push(isArr ? `if(${v}.length<${numLit(schema.minItems)})return false` : `if(Array.isArray(${v})&&${v}.length<${numLit(schema.minItems)})return false`)
+  if (schema.maxItems !== undefined) lines.push(isArr ? `if(${v}.length>${numLit(schema.maxItems)})return false` : `if(Array.isArray(${v})&&${v}.length>${numLit(schema.maxItems)})return false`)
 
   // object size
-  if (schema.minProperties !== undefined) lines.push(`if(${objGuard}Object.keys(${v}).length<${schema.minProperties})return false`)
-  if (schema.maxProperties !== undefined) lines.push(`if(${objGuard}Object.keys(${v}).length>${schema.maxProperties})return false`)
+  if (schema.minProperties !== undefined) lines.push(`if(${objGuard}Object.keys(${v}).length<${numLit(schema.minProperties)})return false`)
+  if (schema.maxProperties !== undefined) lines.push(`if(${objGuard}Object.keys(${v}).length>${numLit(schema.maxProperties)})return false`)
 
   if (schema.pattern) {
     // Try inline charCode compilation for simple patterns (avoids RegExp engine)
@@ -3782,20 +3907,18 @@ function genCodeNode(schema, v, lines, ctx, knownType) {
     }
   }
 
-  if (schema.format) {
-    const fc = FORMAT_CODEGEN[schema.format]
-    if (fc) {
-      lines.push(fc(v, isStr, ctx))
-    } else if (ctx.userFormats && typeof ctx.userFormats[schema.format] === 'function') {
+  // The caller's function for the format wins over the built-in check, as
+  // the interpreted engine and tier 0 read the option; a format named ''
+  // is a name like any other.
+  if (typeof schema.format === 'string') {
+    const uf = userFormatFn(ctx.userFormats, schema.format)
+    if (uf !== null) {
       // User-supplied format checker: thread the function via closure and call at runtime.
-      const safeName = schema.format.replace(/[^a-zA-Z0-9_]/g, '_')
-      const closureName = `_uf_${safeName}`
-      if (!ctx.closureVars.includes(closureName)) {
-        ctx.closureVars.push(closureName)
-        ctx.closureVals.push(ctx.userFormats[schema.format])
-      }
+      const closureName = bindUserFormat(ctx, schema.format, uf)
       const guard = isStr ? '' : `typeof ${v}==='string'&&`
       lines.push(`if(${guard}!${closureName}(${v}))return false`)
+    } else if (Object.hasOwn(FORMAT_CODEGEN, schema.format)) {
+      lines.push(FORMAT_CODEGEN[schema.format](v, isStr, ctx))
     }
   }
 
@@ -4144,8 +4267,8 @@ function genPropertyNamesNode(schema, v, lines, ctx, knownType, isObj) {
     return
   }
   lines.push(`${guard}{${ownHead(ctx, v, `_k${ki}`, 'const')}{`)
-  if (pn.minLength !== undefined) lines.push(`if(_k${ki}.length<${pn.minLength})return false`)
-  if (pn.maxLength !== undefined) lines.push(`if(_k${ki}.length>${pn.maxLength})return false`)
+  if (pn.minLength !== undefined) lines.push(`if(_k${ki}.length<${numLit(pn.minLength)})return false`)
+  if (pn.maxLength !== undefined) lines.push(`if(_k${ki}.length>${numLit(pn.maxLength)})return false`)
   if (pn.pattern) {
     const fast = fastPrefixCheck(pn.pattern, `_k${ki}`)
     if (fast) {
@@ -4181,8 +4304,8 @@ function genPrefixItemsNode(schema, v, lines, ctx, knownType, isArr) {
 
 function genContainsNode(schema, v, lines, ctx, knownType, isArr) {
   const ci = ctx.varCounter++
-  const minC = schema.minContains !== undefined ? schema.minContains : 1
-  const maxC = schema.maxContains !== undefined ? schema.maxContains : Infinity
+  const minC = schema.minContains !== undefined ? numLit(schema.minContains) : 1
+  const maxC = schema.maxContains !== undefined ? numLit(schema.maxContains) : Infinity
   const subLines = []
   genCode(schema.contains, `_cv`, subLines, ctx)
   const fnBody = subLines.length === 0 ? `return true` : `${subLines.join(';')};return true`
@@ -4601,11 +4724,15 @@ function genRefNode(schema, v, lines, ctx, knownType, hasSiblings) {
         ctx.refStack.add(schema.$ref)
         const outerReuse = ctx.plainReuse
         ctx.plainReuse = undefined
+        // Hoisted like the cyclic ones, so a `$ref: '#'` inside reaches the
+        // root through the forwarder rather than naming `_validate`.
+        ctx.inDefFn = (ctx.inDefFn || 0) + 1
         try {
           genIsolated(ctx, () => genCode(ctx.rootDefs[defName], 'd', bodyLines, ctx))
         } finally {
           ctx.refStack.delete(schema.$ref)
           ctx.plainReuse = outerReuse
+          ctx.inDefFn--
         }
         if (ctx.deferredChecks) for (const dc of ctx.deferredChecks) bodyLines.push(dc)
         ctx.deferredChecks = outerDeferred
@@ -4715,8 +4842,8 @@ function genPatternPropertiesNode(schema, v, lines, ctx, knownType, isObj) {
     lines.push(`${guard}{${ownHead(ctx, v, kVar, 'const')}{`)
     // propertyNames checks (merged into same loop)
     if (pn) {
-      if (pn.minLength !== undefined) lines.push(`if(${kVar}.length<${pn.minLength})return false`)
-      if (pn.maxLength !== undefined) lines.push(`if(${kVar}.length>${pn.maxLength})return false`)
+      if (pn.minLength !== undefined) lines.push(`if(${kVar}.length<${numLit(pn.minLength)})return false`)
+      if (pn.maxLength !== undefined) lines.push(`if(${kVar}.length>${numLit(pn.maxLength)})return false`)
       if (pn.pattern) {
         const fast = fastPrefixCheck(pn.pattern, kVar)
         if (fast) {
@@ -4773,8 +4900,8 @@ function genPatternPropertiesNode(schema, v, lines, ctx, knownType, isObj) {
     lines.push(`${guard}{${ownHead(ctx, v, kVar, 'const')}{`)
     // propertyNames checks (merged)
     if (pn) {
-      if (pn.minLength !== undefined) lines.push(`if(${kVar}.length<${pn.minLength})return false`)
-      if (pn.maxLength !== undefined) lines.push(`if(${kVar}.length>${pn.maxLength})return false`)
+      if (pn.minLength !== undefined) lines.push(`if(${kVar}.length<${numLit(pn.minLength)})return false`)
+      if (pn.maxLength !== undefined) lines.push(`if(${kVar}.length>${numLit(pn.maxLength)})return false`)
       if (pn.pattern) {
         const fast = fastPrefixCheck(pn.pattern, kVar)
         if (fast) {
@@ -5016,7 +5143,7 @@ function genUnevaluatedPropertiesNode(schema, v, lines, ctx, knownType, isObj, h
           const bfi = ctx.varCounter++
           ctx.closureVars.push(`_bk${bfi}`)
           ctx.closureVals.push(branchProps)
-          lines.push(`{const ${evVar}={}`)
+          lines.push(`{const ${evVar}=Object.create(null)`)
           for (const k of baseProps) lines.push(`${evVar}[${JSON.stringify(k)}]=1`)
           lines.push(`const _bf${bfi}=[${fns.join(',')}]`)
           if (branchKeyword === 'oneOf') {
@@ -5033,7 +5160,7 @@ function genUnevaluatedPropertiesNode(schema, v, lines, ctx, knownType, isObj, h
         // dependentSchemas: conditional merge at runtime
         const ei = ctx.varCounter++
         const evVar = `_ev${ei}`
-        lines.push(`{const ${evVar}={}`)
+        lines.push(`{const ${evVar}=Object.create(null)`)
         for (const k of baseProps) lines.push(`${evVar}[${JSON.stringify(k)}]=1`)
         for (const [trigger, depSchema] of Object.entries(schema.dependentSchemas)) {
           const depResult = collectEvaluated(depSchema, ctx.schemaMap, ctx.rootDefs)
@@ -5064,7 +5191,7 @@ function genUnevaluatedPropertiesNode(schema, v, lines, ctx, knownType, isObj, h
         if (allPatterns.length > 0) {
           const ei = ctx.varCounter++
           const evVar = `_ev${ei}`
-          lines.push(`{const ${evVar}={}`)
+          lines.push(`{const ${evVar}=Object.create(null)`)
           for (const k of baseProps) lines.push(`${evVar}[${JSON.stringify(k)}]=1`)
           const reVars = []
           for (const pat of allPatterns) {
@@ -5113,7 +5240,7 @@ function genUnevaluatedPropertiesNode(schema, v, lines, ctx, knownType, isObj, h
           // used to emit nothing, and nothing read as valid.
           const ei = ctx.varCounter++
           const evVar = `_ev${ei}`
-          lines.push(`{const ${evVar}={}`)
+          lines.push(`{const ${evVar}=Object.create(null)`)
           for (const k of baseProps) lines.push(`${evVar}[${JSON.stringify(k)}]=1`)
           const inner = `for(var _k in ${v}){if(!${evVar}[_k]&&${ownFail(ctx, v)})return false}`
           _deferOrInline(ctx, lines, v, isObj ? inner + '}' : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}}`)
@@ -5124,7 +5251,7 @@ function genUnevaluatedPropertiesNode(schema, v, lines, ctx, knownType, isObj, h
       const ei = ctx.varCounter++
       const evVar = `_ev${ei}`
       const ukVar = `_uk${ei}`
-      lines.push(`{const ${evVar}={}`)
+      lines.push(`{const ${evVar}=Object.create(null)`)
       for (const k of baseProps) lines.push(`${evVar}[${JSON.stringify(k)}]=1`)
 
       if (branchKeyword) {
@@ -5346,7 +5473,10 @@ const emailHelper = () => `function _em(_s){${getFormats().emailSource('_s', tru
 // each call site, where the tables would have to be rebuilt.
 const uriHelper = () => getFormats().uriHelperSource('_uri')
 
-const FORMAT_CODEGEN = {
+// A table with no prototype, read with Object.hasOwn: `format: 'constructor'`
+// used to find Object here and `format: 'hasOwnProperty'` threw while
+// compiling.
+const FORMAT_CODEGEN = Object.assign(Object.create(null), {
   email: (v, isStr, ctx) => {
     if (!ctx) return getFormats().emailSource(v, isStr)
     hoistOnce(ctx, '_emHoisted', emailHelper())
@@ -5374,7 +5504,11 @@ const FORMAT_CODEGEN = {
     return isStr ? `{${inner}}` : `if(typeof ${v}==='string'){${inner}}`
   },
   date: (...a) => getFormats().dateSource(...a),
-  uuid: (...a) => getFormats().uuidSource(...a),
+  uuid: (v, isStr, ctx) => {
+    if (!ctx) return getFormats().uuidSource(v, isStr)
+    hoistOnce(ctx, '_uuHoisted', getFormats().uuidHelperSource('_uu'))
+    return isStr ? `if(!_uu(${v}))return false` : `if(typeof ${v}==='string'&&!_uu(${v}))return false`
+  },
   'date-time': (...a) => getFormats().dateTimeSource(...a),
   time: (...a) => getFormats().timeSource(...a),
   duration: (...a) => getFormats().durationSource(...a),
@@ -5403,7 +5537,7 @@ const FORMAT_CODEGEN = {
     return isStr ? body : `if(typeof ${v}==='string'){${body}}`
   },
   hostname: (...a) => getFormats().hostnameSource(...a),
-}
+})
 
 // `^[class]+$`, `^[class]{m,n}$` and `^[class]{n}$` for a class of ASCII
 // letters, digits, `_` and `-`: a function in the preamble that reads each
@@ -5525,6 +5659,10 @@ function fixedSequenceInline(pattern, varName) {
       const q = /^\{(\d+)\}/.exec(pattern.slice(i))
       if (!q) return null
       count = Number(q[1])
+      // Checked against the limit before the pieces are pushed: a{100000000}
+      // pushed a hundred million entries first, and a{2000000000} threw a
+      // RangeError out of validate().
+      if (!Number.isSafeInteger(count) || count > 32 - pieces.length) return null
       i += q[0].length
     } else if (i < end && '*+?'.includes(pattern[i])) {
       return null
@@ -5631,8 +5769,10 @@ function fastPrefixCheck(pattern, keyVar) {
     if (alts.length <= 8) return `(${alts.map((a) => `${keyVar}===${JSON.stringify(a)}`).join('||')})`
   }
   if (pattern === '.*') return 'true'
-  // Match patterns like ^literal (no regex metacharacters after ^)
-  const m = pattern.match(/^\^([a-zA-Z0-9_\-./]+)$/)
+  // Match patterns like ^literal (no regex metacharacters after ^). A dot is
+  // a wildcard, so it is not literal: `^a.b` read as the prefix 'a.b' let
+  // 'axb' skip its value schema.
+  const m = pattern.match(/^\^([a-zA-Z0-9_\-/]+)$/)
   if (!m) return null
   const prefix = m[1]
   if (prefix.length === 0 || prefix.length > 8) return null // too long = diminishing returns
@@ -6121,4 +6261,4 @@ Object.defineProperty(module.exports, '_expandDynamicScopes', { value: expandDyn
 // For tests/test_custom_keyword_codegen.js, which holds these copies to the interpreter's.
 Object.defineProperty(module.exports, '_kwTypeBits', { value: { kwTypeBit, kwDataBits, KW_T_ANY }, enumerable: false })
 
-module.exports._internal = { ownHead, plainFlag, hasConstraints, assertEmitted, prepareForCodegen, sharedCodegenGate, codegenSafe, isSimplePN, hasUnresolvableRef, needsBaseTracking, _cpLen, sharedRt, DECLINE, bindRt, compileSafe, emitGuardState, withPlain, REF_NEUTRAL_SIBLINGS, resolveCrossSchemaRef, enumCondition, enumOperand, emitDeq, emitConstant, ownGuard, ownKeyExpr, multipleOfBad, compilePatternInline, useSafeEngine, reFlags, FORMAT_CODEGEN, PROTO_NAMES, setOwn, nestedGenCode, compileToJSCodegen, SKIP_VALUE_KEYS, skipString, CYCLE_DEPTH, cyclicDefNames, sharedDefNames, reFlagArg, hoistOnce, PTR_ESC_HELPER, unevalContributions, emitUq, uqSources, safeReClosure, fastPrefixCheck, replaceTopLevel, refTargetFor, genCode, addLocalAnnotations, addTopApplicatorAnnotations, protoIs, ANNOT_APPLICATORS, SIZE_SKIPS, emitRootGuard, emitGuardedRun, keyLoopEligible, SAME_KEYS_HELPER, seqTag }
+module.exports._internal = { ownHead, plainFlag, hasConstraints, assertEmitted, prepareForCodegen, sharedCodegenGate, codegenSafe, isSimplePN, hasUnresolvableRef, needsBaseTracking, _cpLen, sharedRt, DECLINE, bindRt, compileSafe, emitGuardState, withPlain, REF_NEUTRAL_SIBLINGS, resolveCrossSchemaRef, enumCondition, enumOperand, emitDeq, emitConstant, ownGuard, ownKeyExpr, multipleOfBad, compilePatternInline, useSafeEngine, reFlags, FORMAT_CODEGEN, PROTO_NAMES, setOwn, nestedGenCode, compileToJSCodegen, SKIP_VALUE_KEYS, skipString, CYCLE_DEPTH, cyclicDefNames, sharedDefNames, reFlagArg, hoistOnce, PTR_ESC_HELPER, unevalContributions, emitUq, uqSources, safeReClosure, fastPrefixCheck, replaceTopLevel, refTargetFor, genCode, addLocalAnnotations, addTopApplicatorAnnotations, protoIs, ANNOT_APPLICATORS, SIZE_SKIPS, emitRootGuard, emitGuardedRun, keyLoopEligible, SAME_KEYS_HELPER, seqTag, numLit, hasNonNumericBound, patternEngineOk, ufName, userFormatFn, bindUserFormat, formatNameOf }

package/lib/json-rejections.js

@@ -97,7 +97,7 @@ Object.defineProperty(LazyJsonRejection.prototype, 'errors', {
           if (e && !e.dataFrame) {
             const path = e.path != null ? e.path : (e.instancePath || '');
             const p = positions[path];
-            if (p) e.dataFrame = { byteOffset: p.byteOffset, length: p.length, line: p.line, col: p.col, text: p.text };
+            if (p) { e.dataFrame = { byteOffset: p.byteOffset, length: p.length, line: p.line, col: p.col, text: p.text }; if (p.textCol !== undefined) e.dataFrame.textCol = p.textCol; }
           }
         }
         self._posCache.reset();

package/lib/migrate.js

@@ -68,10 +68,29 @@ function mask (src) {
   return out.join('');
 }
 
+// The line of `index` in `src`. The callers ask for ascending indexes of one
+// file, so the count continues from the last answer rather than from the
+// start: counted from the start for each match, 40000 requires took 16 s.
+let lineSrc = null;
+let lineIdx = 0;
+let lineNo = 1;
 function lineOf (src, index) {
-  let line = 1;
-  for (let i = 0; i < index; i++) if (src.charCodeAt(i) === 10) line++;
-  return line;
+  if (src !== lineSrc || index < lineIdx) { lineSrc = src; lineIdx = 0; lineNo = 1; }
+  for (let i = lineIdx; i < index; i++) if (src.charCodeAt(i) === 10) lineNo++;
+  lineIdx = index;
+  return lineNo;
+}
+
+// A file name or a source line as the report prints it: control characters
+// and the Unicode line separators written as escapes, so a name cannot
+// forge a line or a colour on the terminal.
+function plain (s) {
+  return String(s).replace(/[\x00-\x1f\x7f\u2028\u2029]/g, (c) => {
+    if (c === '\n') return '\\n';
+    if (c === '\r') return '\\r';
+    if (c === '\t') return '\\t';
+    return '\\u' + c.charCodeAt(0).toString(16).padStart(4, '0');
+  });
 }
 
 // Every module specifier in `src`: the string following `from`, inside
@@ -238,8 +257,8 @@ function formatReport (result, opts = {}) {
   }
   const label = { rewrite: 'rewrite', delete: 'delete ', flag: 'flag   ' };
   for (const r of result.report) {
-    lines.push(r.file);
-    for (const f of r.findings) lines.push(`  ${label[f.kind]}  line ${String(f.line).padStart(4)}  ${f.text}`);
+    lines.push(plain(r.file));
+    for (const f of r.findings) lines.push(`  ${label[f.kind]}  line ${String(f.line).padStart(4)}  ${plain(f.text)}`);
   }
   const rewrites = result.report.reduce((n, r) => n + r.findings.filter((f) => f.kind !== 'flag').length, 0);
   lines.push('');

package/lib/native-attach.browser.js

@@ -0,0 +1,7 @@
+'use strict';
+
+// The browser has no native engine; see lib/native-attach.js.
+function attachNative() {}
+// Unreachable without an addon; validator-core returns before it.
+attachNative.installFast = function installFast() {};
+module.exports = attachNative;